en
CISA, the Cybersecurity and Infrastructure Security Agency, is a U.S. Department of Homeland Security agency focused on cybersecurity, infrastructure security, emergency communications, and national resilience. It provides services, guidance, training, assessments, and selected no-cost tools to public- and private-sector partners across the United States.
As of 09/15/2026, CISA recorded 15 security vulnerabilities in the last 90 days across 1 products, including 6 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Malcolm had the most security vulnerabilities in the CISA ecosystem, with 15 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-90457 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityMedium |
CVE-2026-90456 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityCritical |
CVE-2026-90455 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityMedium |
CVE-2026-90454 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityMedium |
CVE-2026-90453 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityMedium |
CVE-2026-90452 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityMedium |
CVE-2026-90451 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityHigh |
CVE-2026-90450 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityMedium |
CVE-2026-90449 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityMedium |
CVE-2026-90448 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityHigh |
CVE-2026-90447 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityHigh |
CVE-2026-90446 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityMedium |
CVE-2026-90445 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityHigh |
CVE-2026-90444 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityHigh |
CVE-2026-90443 | Exploitation statusNot confirmed | FixYes | Affected productMalcolm | Published09/11/2026 | SeverityMedium |
CVE-2026-43510CISA manage.get.gov insecure portfolio administrative privileges | Exploitation statusNot known exploited | FixYes | Affected productmanage.get.gov | Published05/07/2026 | SeverityMedium |
CVE-2025-67634Software Acquisition Guide Supplier Response Web Tool XSS | Exploitation statusPublic exploit | FixYes | Affected productSoftware Acquisition Guide Tool | Published12/12/2025 | SeverityMedium |
CVE-2025-35436CISA Thorium account verification email error handling | Exploitation statusNot known exploited | FixYes | Affected productThorium | Published09/17/2025 | SeverityMedium |
CVE-2025-35435CISA Thorium download stream divide by zero | Exploitation statusPublic exploit | FixYes | Affected productThorium | Published09/17/2025 | SeverityMedium |
CVE-2025-35434CISA Thorium does not validate TLS connections to Elasticsearch | Exploitation statusPublic exploit | FixYes | Affected productThorium | Published09/17/2025 | SeverityLow |
CVE-2025-35433CISA Thorium does not properly invalidate previously used tokens | Exploitation statusNot known exploited | FixYes | Affected productThorium | Published09/17/2025 | SeverityLow |
CVE-2025-35432CISA Thorium does not rate limit account verification email messages | Exploitation statusNot known exploited | FixYes | Affected productThorium | Published09/17/2025 | SeverityMedium |
CVE-2025-35431CISA Thorium LDAP injection | Exploitation statusNot known exploited | FixYes | Affected productThorium | Published09/17/2025 | SeverityMedium |
CVE-2025-35430CISA Thorium insecure downloaded file path validation | Exploitation statusPublic exploit | FixYes | Affected productThorium | Published09/17/2025 | SeverityMedium |
CVE-2023-7242Ethercat Zeek Plugin Out-of-bounds Read | Exploitation statusNot known exploited | FixYes | Affected productIndustrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Plugin for Zeek | Published03/01/2024 | SeverityHigh |
CVE-2023-7243Ethercat Zeek Plugin Out-of-bounds Write | Exploitation statusNot known exploited | FixYes | Affected productIndustrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Plugin for Zeek | Published03/01/2024 | SeverityCritical |
CVE-2023-7244Ethercat Zeek Plugin Out-of-bounds Write | Exploitation statusNot known exploited | FixYes | Affected productIndustrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Plugin for Zeek | Published03/01/2024 | SeverityCritical |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
%20-%20Ethercat%20Plugin%20for%20Zeek.svg){kind=icon}
